3 ms·
> Read the proposal I have, and that is not a viewpoint unless you wrote the proposal. > if you have read the proposal, it's clear that they are being careful
by dns_snek 3y ago
> Read the proposal
I have, and that is not a viewpoint unless you wrote the proposal.
> if you have read the proposal, it's clear that they are being careful and are upfront about the some potential misuses and the proposed handing of them.
The goal of the proposal is strictly incompatible with our freedoms. After all, restricting which devices, environments and software we're allowed to use to visit the website is the entire point of this proposal, is it not?
> again there is no such thing proposed. The "attester" is not specifically Google. anyone can become an "attester". The chain of trust is a chain that trusts tokens not specific "things". if you for example would trust let's say Opera as the attester, Opera would need to trust windows or Linux or Android as the OS attester.
So what? Even if this were true in any practical sense, as a user I have no control over which attesters the website trusts - and they will require attestation from parties that attest that I'm running the latest version of Windows or MacOS with Spyware version 5.49.182 installed, and another party that attests that their ads are visible in my framebuffer.
That won't happen immediately, of course, it would be much too obvious. But introduction of WEI establishes a clear path forward towards that reality. Once WEI is in place, the chain of trust will continuously creep up the stack until everything from the TPM chip up to your framebuffer and display is locked down. They'll slowly boil the frog, like they always do.
> The analogy here is the certificate Authorities. You may very well have a "let's encrypt" attester that democratizes the good parts (certification) without the bad parts (too much information) .
That's a terrible analogy. For one, the only thing TLS server certificates attest to is that I *the user* am connected to the *server* that I intended to connect to.
A better analogy would be mandatory TLS client certificates which would attest that I'm John Doe, underage, registered to reside in a country where the legal drinking age is 18, warning the websites that my juvenile criminal record is spotty. That's what WEI is comparable to, and you'd see a similar level of pushback if that's what was being introduced.